medium5.9
CVE-2025-30218
Next.js may leak x-middleware-subrequest-id to external hosts
Impact
## Summary In the process of remediating [CVE-2025-29927](https://github.com/advisories/GHSA-f82v-jwr5-mffw), we looked at other possible exploits of Middleware. We independently verified this low severity vulnerability in parallel with two reports from independent researchers. Learn more [here](https://vercel.com/changelog/cve-2025-30218-5DREmEH765PoeAsrNNQj3O). ## Credit Thank you to Jinseo Kim [kjsman](https://hackerone.com/kjsman?type=user) and [RyotaK](https://hackerone.com/ryotak?type=user) (GMO Flatt Security Inc.) with [takumi-san.ai](https://takumi-san.ai) for the responsible disclosure. These researchers were awarded as part of our bug bounty program.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | next | = 12.3.5 | 12.3.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vercel | Next.Js | Versions 12.3.5, 13.5.9, 14.2.25, 15.2.3 |